An Empirical Comparison of Widely Adopted Hash Functions in Digital Forensics: Does the Programming Language and Operating System Make a Difference?

Hash functions are widespread in computer sciences and have a wide range of applications such as ensuring integrity in cryptographic protocols, structuring database entries (hash tables) or identifying known files in forensic investigations. Besides their cryptographic requirements, a fundamental property of hash functions is efficient and easy computation which is especially important in digital forensics due to the large amount of data that needs to be processed when working on cases. In this paper, we correlate the runtime efficiency of common hashing algorithms (MD5, SHA-family) and their implementation. Our empirical comparison focuses on C-OpenSSL, Python, Ruby, Java on Windows and Linux and C and WinCrypto API on Windows. The purpose of this paper is to recommend appropriate programming languages and libraries for coding tools that include intensive hashing processes. In each programming language, we compute the MD5, SHA-1, SHA-256 and SHA-512 digest on datasets from 2MB to 1 GB. For each language, algorithm and data, we perform multiple runs and compute the average elapsed time. In our experiment, we observed that OpenSSL and languages utilizing OpenSSL (Python and Ruby) perform better across all the hashing algorithms and data sizes on Windows and Linux. However, on Windows, performance of Java (Oracle JDK) and C WinCrypto is comparable to OpenSSL and better for SHA-512

Depressio biparietalis circumscripta chez les anciens Egyptiens

Four skulls, showing biparietal circumscribed depressions in diminishing degrees, out of 27 specimens found in a série of skeletons excavated in 1912-1914 around the great pyramid of Cheops, are presented, the criterion of their homology is exposed, their frequency discussed, and arguments for the designation proposed in the title of the paper are set forth.Quatre crânes, montrant des dépressions bipariétales circonscrites en degrés décroissants, et tirés d'un ensemble de 27 spécimens, trouvés dans une série de squelettes mise à jour en 1912-1914 autour de la grande pyramide de Chéops, sont présentés. Le critère de l'homologie de cette anomalie est mis en évidence, sa fréquence discutée et les arguments pour l'appellation proposée (titre de l'article) sont exprimés.Breitinger E. Depressio biparietalis circumscripta chez les anciens Egyptiens. In: Bulletins et Mémoires de la Société d'anthropologie de Paris, XIII° Série. Tome 10 fascicule 1, 1983. pp. 71-79

Expediting MRSH-v2 Approximate Matching with Hierarchical Bloom Filter Trees

Bytewise approximate matching algorithms have in recent years shown significant promise in de- tecting files that are similar at the byte level. This is very useful for digital forensic investigators, who are regularly faced with the problem of searching through a seized device for pertinent data. A common scenario is where an investigator is in possession of a collection of known-illegal files (e.g. a collection of child abuse material) and wishes to find whether copies of these are stored on the seized device. Approximate matching addresses shortcomings in traditional hashing, which can only find identical files, by also being able to deal with cases of merged files, embedded files, partial files, or if a file has been changed in any way. Most approximate matching algorithms work by comparing pairs of files, which is not a scalable approach when faced with large corpora. This paper demonstrates the effectiveness of using a Hierarchical Bloom Filter Tree (HBFT) data structure to reduce the running time of collection-against-collection matching, with a specific focus on the MRSH-v2 algorithm. Three experiments are discussed, which explore the effects of different configurations of HBFTs. The proposed approach dramatically reduces the number of pairwise comparisons required, and demonstrates substantial speed gains, while maintaining effectiveness

Nepal -- Nested Data-Parallelism in Haskell

This paper discusses an extension of Haskell by support for nested data-parallel programming in the style of the special-purpose language Nesl. More precisely, the extension consists of a parallel array type, array comprehensions, and a set of primitive parallel array operations. This extension brings a hitherto unsupported style of parallel programming to Haskell. Moreover, nested data parallelism should receive wider attention when available in a standardised language like Haskell. This paper outlines the language extension and demonstrates its usefulness with two case studies